Italian DPA finds Ministry of Education's disclosure of disciplinary dismissal excessive

[Web Doc. No. 10287373] Decision of July 23, 2026 Register of Decisions No. 553 of July 23, 2026 THE DATA PROTECTION AUTHORITY AT today’s meeting, attended by Prof. Pasquale Stanzione, Chair; Prof. Ginevra Cerrina Feroni, Vice Chair; Dr. Agostino Ghiglia, Member; and Dr. Luigi Montuori, Secretary General; HAVING REGARD TO Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016, on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC, “General Data Protection Regulation” (hereinafter “Regulation”); HAVING REGARD TO Legislative Decree No. 196 of June 30, 2003, containing the “Code on Data Protection,” which sets forth provisions for the adaptation of national law to Regulation (EU) 2016/679 of the European Parliament and of the Council, of April 27, 2016, on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC” (hereinafter “Code”); HAVING REGARD TO Regulation No. 1/2019 concerning internal procedures with external relevance, aimed at carrying out the tasks and exercising the powers entrusted to the Data Protection Authority, approved by Resolution No. 98 of April 4, 2019, published in the Official Gazette No. 106 of May 8, 2019, and at www.gpdp.it, web doc. No. 9107633 (hereinafter “Regulation of the Data Protection Authority No. 1/2019”); Having regard to the documentation on file; Having regard to the observations made by the Secretary General pursuant to Article 15 of the Data Protection Authority Regulation No. 1/2000 on the organization and operation of the office of the Data Protection Authority, web doc. No. 1098801; Rapporteur: Prof. Pasquale Stanzione; PREAMBLE

Introduction. In a complaint filed pursuant to Article 77 of the Regulation, Ms. XX, an employee of the Ministry of Education and Merit classified in the ATA staff category, alleged a violation of the regulations governing data protection. Specifically, it was alleged that, after being the recipient of a disciplinary dismissal decision issued by the Disciplinary Proceedings Office (UPD) of the Monza and Brianza Territorial School Office, numerous branches of the Administration (namely, all regional school offices; all schools within the territorial area; the teacher and ATA ranking office; the teacher and ATA appointment office; and the pension office) had been notified of the dismissal via email.

The Preliminary Investigation. In response to a request for information made pursuant to Art. 157 of the Code (see note ref. no. XX dated XX), the Ministry of Education and Merit—Regional School Office for Lombardy, in a letter dated XX (Ref. No. XX), stated, in particular, that: - “the [UPD], by order Ref. No. XX dated XX, imposed on the [complainant…] the penalty of dismissal with notice pursuant to Article 25, paragraph 9, Chapter I, subparagraphs (a) and (g) of the National Collective Bargaining Agreement for the Education and Research Sector for the 2019–2021 three-year period”; - the aforementioned Office “by confidential memorandum ref. no. XX dated XX […] notified all Regional School Offices, the State Schools within the Monza and Brianza Territorial Area, as well as to the Teacher and ATA Ranking Offices and the Pensions Office within the Monza and Brianza Territorial Area, the name and identifying information of the employee who, following the disciplinary proceedings, had been subjected to the sanction of dismissal […]”; - “the other Regional Education Offices—as well as the Territorial Area Offices—cannot in any way be classified as ‘third parties,’ since they are offices lacking legal autonomy, merely serving as regional and provincial territorial branches of the same, single School Administration of the Ministry […]”; - “The same applies to educational institutions which, although endowed with autonomy […], are functionally ‘subordinate’ to the Ministry […] and, in particular, school staff are employed by the Ministry”; - “[…] notification of dismissal […] to the branches of the same Ministry appears necessary to ensure the legality of recruitment procedures at the Territorial Offices and educational institutions, thereby preventing the dismissed employee—by failing to disclose the disciplinary action taken against them—from entering into employment contracts with the school administration”; - “since […] the disciplinary sanction of dismissal constitutes a specific barrier to participation in competitive selection procedures and to the inclusion of the data subject in provincial and school-level rankings for substitute teaching positions, the aforementioned notice was sent to the aforementioned Offices for their information and for any necessary decisions within their jurisdiction”; - the complainant, in fact, “[…] could have submitted an application to a School Office of the Republic and to a School Institution of the Republic for inclusion in the first- and third-tier rankings, respectively”;the notification to the Offices […], therefore, was necessary as the only way to prevent the dismissed employee—by failing to disclose a disciplinary dismissal—from being included in the provincial and school-level rankings in Lombardy and other regions, in violation of the provisions of Art. 2, paragraph 7, of Presidential Decree No. 487 of May 9, 1994, which provides that ‘those who have been […] dismissed for […] disciplinary reasons pursuant to applicable statutory or contractual provisions may not be hired by public administrations’”; - “Ministerial Order No. 21 of February 23, 2009 […] in Art. 7.3(c), provides that “those who have incurred the disciplinary sanctions provided for by the current National Collective Bargaining Agreement for the school sector (dismissal with notice and dismissal without notice) may not participate in the procedure” and similarly, Decree No. 89 of May 21, 2024, of the Ministry of Education and Merit […] provides that “those who have been dismissed or relieved of duty from a public administration due to persistent unsatisfactory performance, or who have been terminated for just cause or for a justified subjective reason, may not participate in the hiring process””; - “Notification to other offices of the mere termination of the employee’s employment relationship, without making specific reference to the disciplinary dismissal decision, cannot be considered sufficient to satisfy the legal purpose indicated above - specifically, the purpose of precluding the data subject from being rehired - since the termination of employment constitutes a very broad category that includes, for example, voluntary resignations, which do not preclude the employee from applying for inclusion in the rankings of any province or educational institution, with the possible subsequent execution of employment contracts with the administration. The contested notice is also necessary for the employer to address false statements regarding the fulfillment of the requirements prescribed by sector-specific regulations.” By letter dated XX (Ref. No. XX), the Office of the Data Protection Commissioner, based on the information gathered, the verifications conducted, and the facts that emerged following the preliminary investigation, notified the Ministry of Education and Merit - the Regional School Office for Lombardy, pursuant to Article 166, paragraph 5, of the Code, the initiation of proceedings for the adoption of the measures referred to in Article 58, para 2, of the Regulation, for having conducted personal data processing relating to the disciplinary measure in a manner inconsistent with the principle of “lawfulness, fairness, and transparency” and in the absence of a legal basis, in violation of Articles 5(1)(a), 6(1)(c) and (e), and 6(2) and (3) of the Regulation, as well as Article 2-ter of the Code. In the same notice, the aforementioned data controller was invited to submit a written defense or supporting documents to the Data Protection Authority or to request a hearing before the Authority (Art. 166, paragraphs 6 and 7, of the Code, as well as Art 18, paragraph 1, of Law No. 689 of November 24, 1981). By letter dated XX (Ref. No. XX), the Ministry of Education and Merit—Regional School Office for Lombardy—submitted a defense brief, stating, in particular, that: - “[…] the main activity of the Territorial Areas consists in recruiting school staff to ensure the proper start of the school year, using [, in particular…] the ‘24-month’ rankings for ATA staff […]. The same applies to educational institutions that fill vacant and available positions with substitute teachers, as well as to replace staff absent for various reasons during the school year, using […] the third-tier school-specific rankings for ATA staff”; - it is necessary to “prevent […] a dismissed employee, by failing to disclose the disciplinary sanction incurred—which precludes hiring—from entering into employment contracts with the school administration […]. To enable the rapid retrieval of such information, the offices of the Ministry of Education and Merit exchange the contested communications—internal documents within the Ministry’s territorial divisions—in compliance with privacy regulations, and also send them to educational institutions, which are themselves divisions of the Ministry”; - “the ranking/appointment offices […], although part of the same administration, are responsible for verifying the requirements under Article 2, paragraph 7, of Presidential Decree No. 487/1994”; - “The legal framework provides for a converging set of sources that establish a prohibition on hiring individuals who have been dismissed for disciplinary reasons, creating an implicit yet stringent and timely obligation for internal communication […]. “When read systematically, these provisions stipulate that the candidate’s self-certification alone is not sufficient […]”; - “[…] the recipients of the notice have specific institutional duties that require knowledge of the disciplinary dismissal […]”; - “[…] the Regional School Offices (UU.SS.RR.) and Territorial School Offices (UU.SS.TT.) need to be aware of disciplinary dismissals in order to prevent dismissed personnel from being rehired during recruitment processes through self-certification, by failing to disclose the cause of the termination of their previous employment relationship, as do school administrators responsible for recruiting teachers and ATA staff from school-level ranking lists. Similarly, the Teacher and ATA Ranking Offices of the Monza and Brianza Territorial Area—which handle recruitment from the GAE and GPS for teachers and from the “24-month” ranking for ATA staff, respectively, need to be informed of disciplinary dismissals in order to prevent the fraudulent inclusion of dismissed staff. Furthermore, the notification was forwarded to the Pension Office of the Monza Territorial Area (AT) to complete all procedures resulting from the termination of employment […;] the recipient offices require this information not to manage the employment relationship that has already ended, but to prevent unlawful inclusions in ranking lists of other provinces, prevent the permanent appointment of individuals who do not meet the legal requirements, and comply with the verification obligation imposed by Art. 2, paragraph 7, of Presidential Decree 487/1994”; - “The verification under Article 71 is not structurally suitable for the education sector, as administrative offices and schools conduct verifications ‘including on a sample basis’ and ‘in cases of reasonable doubt.’ In particular, the provincial rankings (GAE, GPS, and 24-Month Rankings) and school-level rankings (Categories I and II for teaching staff and Category III for ATA staff) for substitute teaching positions involve tens of thousands of candidates in each province; appointments are made within extremely tight timeframes, often automatically via an algorithm, which makes it difficult to conduct comprehensive preventive checks; “reasonable doubt” presupposes that the relevant administrative body already possesses information regarding the candidate that the self-certification system, by definition, does not provide if the data subject makes a false declaration. Furthermore, random sampling is, by definition, probabilistic and does not guarantee the detection of every single false statement”; - “A school administration office that possesses information regarding one of its employees—in particular, regarding a condition that precludes employment—is obligated under Article 97 of the Constitution to make such information available to other offices within the same administration […]; there is no automated national database of disciplinary sanctions against school staff accessible to all Regional Offices and schools that manage ranking lists and hiring. It is therefore necessary for the Offices to comply with the legal obligation not to hire or include on ranking lists individuals who have been dismissed for disciplinary reasons […]”; - “the Monza and Brianza Territorial Office has [nevertheless] suspended all communications regarding disciplinary dismissals […] pending the decisions that will be made.”

Outcome of the preliminary investigation. Following the investigation into the complaint, it was established that, after imposing a disciplinary dismissal on the complainant, the Disciplinary Proceedings Office of the Monza and Brianza Territorial Area, via an email dated XX (ref. no. XX), with the subject line “CONFIDENTIAL_Notice of Disciplinary Dismissal Measures,” sent, as an attachment to said email, the note ref. no. XX dated XX, with the subject line “Notification of disciplinary dismissal measures against staff employed at educational institutions falling under the jurisdiction of the Monza and Brianza Territorial Area - School Year 2024–2025,” addressed to “the Regional School Offices,” the “Principals of State Educational Institutions of all levels and instances – Monza and Brianza Territorial Area,” as well as “the Teacher and ATA Ranking Offices,” “Teacher and ATA Appointments,” and “Pensions.” This notice informed the recipients “for their information and to fulfill their respective obligations, [of] the name of the employee to whom, following the outcome of the disciplinary proceedings, this Territorial Area imposed the sanction of dismissal with notice […]”; the complainant was identified therein by reference to her first name, last name, place and date of birth, and job title, and explicit reference was made to the type of disciplinary sanction imposed, as well as the date and reference number of the disciplinary measure in question. That said, it should be noted that public entities, within the workplace context, may process the personal data of data subjects if the processing is necessary, in general, for the management of the employment relationship and to fulfill specific obligations or tasks provided for by law or by Union or Member State law; Furthermore, processing is lawful when it is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller (Articles 6, para 1, subparagraphs (c) and (e), and para 2 and para 3, of the Regulation). European legislation provides that “Member States may maintain or introduce more specific provisions to adapt the application of the rules of the […] Regulation with regard to processing, in accordance with paragraph 1, subparagraphs (c) and (e), by laying down more specific requirements for processing and other measures to ensure lawful and fair processing […]” (Art. 6, para. 2, of the Regulation). In this regard, it should be noted that the “disclosure” of personal data to third parties by public entities is permitted only if the conditions set forth in Art. 2-ter of the Code are met. The controller is required, in any case, to comply with data protection principles, including those of “lawfulness, fairness, and transparency” as well as “data minimisation,” according to which personal data must be “processed lawfully, fairly, and transparently in relation to the data subject” and “adequate, relevant, and limited to what is necessary in relation to the purposes for which they are processed” (Art. 5, para. 1, subsections (a) and (c), of the Regulation). In this context, public administrations must adopt the most appropriate measures to prevent the unjustified disclosure of personal data to third parties or entities other than the recipient (see section 5.3 of the “Guidelines on the Processing of Employees’ Personal Data for the Purpose of Managing Employment Relationships in the Public Sector,” provision of June 14, 2007, at www.gpdp.it, web doc. no. 1417809). In the case at hand, the Ministry of Education and Merit—Regional School Office for Lombardy—has not cited any provision of the school regulations, suitable in terms of rank and nature, that expressly provides for thean obligation for the UPD to inform other Regional School Offices or state schools of all instances within the same territorial jurisdiction, or other offices of the Ministry, regarding the imposition of disciplinary measures involving dismissal against teachers or administrative staff. In this regard, the defense’s argument—that such disclosure of personal data was necessary pursuant to the provisions of Article 2, paragraph 7, of Presidential Decree No. 487 of May 9, 1994, which states that “persons who have been […] dismissed for […] disciplinary reasons pursuant to applicable statutory or contractual provisions may not be hired by public administrations.” This is because the same decree, in Art 4, paragraph 2, subparagraph f), provides that, as part of the application process for a competitive selection procedure through the InPA Portal, the candidate must only declare, “as a declaration in lieu of certification pursuant to Article 46 of the Consolidated Text referred to in Presidential Decree No. 445 of December 28, 2000, […] that they have not been […] dismissed pursuant to applicable statutory or contractual provisions.” The accuracy of this declaration may then be verified by the administering authority in accordance with the procedures set forth in Article 71 of Presidential Decree No. 445 of December 28, 2000, namely, “including on a random basis […] and in cases of reasonable doubt.” Similarly, Ministerial Order No. 21 of February 23, 2009—which was also invoked to support the lawfulness of the conduct in the case subject to the complaint—provides that “those who […] have been subject to the disciplinary sanctions provided for in the current national collective bargaining agreement for the ‘School’ sector (dismissal with notice and dismissal without notice) may not participate in the procedure” (Art. 7.3, subpar. c)), since it is stipulated in this regard that “the application form must state, pursuant to Presidential Decree No. 445 of December 28, 2000, the requirements for admission to the competitive examination […]” and that “the Administration reserves the right to verify the declarations and self-certifications” (Art. 8.8). Therefore, since the possibility that an employee who has been subject to disciplinary dismissal might apply for another competitive selection process or request inclusion in school rankings is merely hypothetical, and since the sector-specific regulations, even in such a scenario, having established specific procedures for certifying participation requirements and conducting the relevant verifications, the processing at issue in the complaint is not supported by the sector-specific regulations governing the matter and is therefore not supported by a legal basis. As for the claim made during the preliminary investigation that the recipients of the email in question cannot be considered third parties—since they are merely internal units of the Ministry—it should be noted that, as the Data Protection Authority has long clarified through general provisions and decisions on individual cases, the personal data of employees, processed for the purposes of managing the employment relationship—including information concerning the termination thereof (see Art. 88, para. 1, of the Regulation, which expressly mentions the “purpose of termination of the employment relationship”) cannot, in fact, as a general rule, be disclosed to parties other than those who are part of the specific employment relationship (see the definitions of “personal data” and “data subject” contained in Art. 4, para. 1, no. 1, of the Regulation), that is, those who—even taking into account the definition of “third party” contained in Art. 4(1)(10) of the Regulation—are not authorized to process such data by virtue of their assigned duties and the organizational decisions of the controller. This applies even within particularly complex and geographically structured organizations, such as that of the Ministry in question. Conversely, no violation of personal data protection regulations can be found in cases where individuals responsible for specific duties become aware of the personal data of data subjects when such knowledge is necessary for the performance of their assigned functions. The Data Protection Authority has applied these principles consistently in numerous specific cases. Furthermore, educational institutions—which were also among the recipients of the aforementioned notice—are to be considered legal entities distinct from the Ministry and, therefore, from the perspective of personal data protection, they act as independent controllers of processing. The recipients of the notice sent by the Office of Disciplinary Proceedings (all Regional School Offices throughout the country; public schools of all levels and instances within the territory; the Teacher and ATA Ranking Offices, Teacher and ATA Appointments, and Pensions) had no need to be informed in advance of the disciplinary measure of dismissal imposed on the complainant; that is to say, regardless of any new application or request to fill a job position, they could not, therefore, consider themselves authorized to perform the data processing, and consequently, their classification as “third parties” for the purposes of personal data protection legislation became relevant; to the extent that the communication in question was addressed to them in a generic manner “for their information and to fulfill their respective obligations,” without specifying—not even during the preliminary investigation—the nature of the specific obligations incumbent upon the aforementioned offices that might necessitate the processing of the information in question for the performance of their respective institutional duties. Also in accordance with the principles of data processing necessity and data minimisation (see Articles 6(1)(c) and 5(1)(c) and (e), and para 2 and para 3, of the Regulation), it would have been, on the other hand, sufficient, for the purposes of any obligations falling within their purview, to provide only the information that the employment relationship had been terminated, without details regarding the lawsuit that led to its termination. This is also true considering that information regarding disciplinary dismissal, even if it does not fall within the special categories of data referred to in Article 9 of the Regulation, constitutes, in any case, particularly sensitive information which, if made available—as occurred in the present case—to a wide audience of recipients, can have significant detrimental effects on the personal and professional legal sphere of the data subject. In light of the foregoing considerations, it must be concluded that, by disclosing the complainant’s personal data in the case at issue, the Ministry of Education and Merit—Regional School Office for Lombardy—acted in a manner inconsistent with the principle of “lawfulness, fairness, and transparency” and without a legal basis, in violation of Articles 5(1)(a), 6(1)(c) and (e), and 6(2) and (3) of the Regulation, as well as Article 2-ter of the Code.

Conclusions. In light of the assessments outlined above, it is noted that the statements made by the controller during the preliminary investigation—for the veracity of which the controller may be held accountable pursuant to Article 168 of the Code—although worthy of consideration, do not suffice to rebut the objections notified by the Office in the notice initiating the proceedings and are insufficient to warrant the dismissal of these proceedings, especially since none of the cases provided for in Art. 11 of the Data Protection Authority’s Regulation No. 1/2019 apply. Therefore, the preliminary assessments of the Data Protection Authority’s Office are confirmed, and the processing of personal data by the Ministry of Education and Merit—Regional School Office for Lombardy—is found to be unlawful, as it processed the complainant’s personal data in violation of Articles 5, (1)(a), and 6(1)(c) and (e), and (2) and (3) of the Regulation, as well as Article 2-ter of the Code. Given that the violation of the aforementioned provisions occurred as a result of a single act (the same processing operation or related processing operations), Article 83, para 3 of the Regulation applies, pursuant to which the total amount of the administrative fine shall not exceed the amount specified for the most serious violation. Given that, in the present case, all violations are subject to the penalty provided for in Article 83, para 5, of the Regulation, as also referred to in Article 166, para 2, of the Code, the total amount of the fine shall be set at up to 20,000,000 euros. In this context, and considering, in any event, that the conduct has ceased to have any effect, the conditions for adopting further corrective measures under Article 58(2) of the Regulation are not met.

Adoption of the injunction order for the imposition of the administrative fine and ancillary penalties (Articles 58(2)(i) and 83 of the Regulation; Article 166, paragraph 7, of the Code). The Data Protection Authority, pursuant to Articles 58(2)(i) and 83 of the Regulation, as well as Article 166 of the Code, has the power to “impose an administrative fine pursuant to Article 83, in addition to the [other] [corrective] measures referred to in this paragraph, or in lieu of such measures, depending on the circumstances of each individual case” and, in this context, “the Board [of the Data Protection Authority] issues an injunction, by which it also orders the application of the ancillary administrative sanction of publication, in full or in part, on the Data Protection Authority’s website pursuant to Article 166, paragraph 7, of the Code” (Art. 16, paragraph 1, of the Data Protection Authority’s Regulation No. 1/2019). In this regard, taking into account Article 83(3) of the Regulation, in the present case the violation of the aforementioned provisions is subject to the application of the administrative fine provided for in Article 83(5) of the Regulation. The amount of the aforementioned administrative fine imposed, depending on the circumstances of each individual case, must be determined by taking due account of the factors set forth in Article 83(2) of the Regulation. Taking into account that: - although the data were disclosed to a wide audience and the processing involved sensitive data—as they related to a disciplinary measure—the established violation concerned the personal data of only one data subject (see Article 83(2)(a) and (g) of the Regulation); - the violation was negligent in nature, as the data controller made a legal error in interpreting the relevant legislation and applying it within the specific and complex organizational context of the education sector, albeit with the intention of protecting the public interest (see Article 83(2)(b) of the Regulation); it is considered that, in the present case, the level of severity of the violation committed by the controller is low (see European Data Protection Board, “Guidelines 4/2022 on the calculation of administrative fines under the GDPR” of May 24, 2023, paragraph 60). That said, given that the controller is a Ministry (even though the violation occurred within a specific division of that Ministry), it is considered that, for the purposes of determining the amount of the fine, the following circumstances must be taken into account: - the controller cooperated fully with the Authority during the investigation and has also suspended the operational practice previously followed (see Art. 83, para. 2, subpar. f), of the Regulation); - there are no relevant prior violations committed by the controller (see Art. 83(2)(e) of the Regulation). In light of the aforementioned factors, assessed as a whole, the Authority has determined the amount of the administrative fine to be 10,000 (ten thousand) euros for the violation of Articles 5(1)(a) and 6(1), para 1, subparagraphs (c) and (e), and para 2 and para 3 of the Regulation, as well as Article 2-ter of the Code, as an administrative fine deemed, pursuant to Article 83(1) of the Regulation, to be effective, proportionate, and dissuasive. It is also deemed that, pursuant to Article 166, paragraph 7, of the Code and Article 16, paragraph 1, of the Data Protection Authority’s Regulation No. 1/2019, this section containing the injunction order must be published on the Data Protection Authority’s website. This is in light of the sensitive nature of the data being disclosed to a wide range of third parties and the potential adverse consequences for the complainant’s private and professional life. Finally, it is noted that the conditions set forth in Article 17 of Regulation No. 1/2019 are met. IN VIEW OF THE FOREGOING, THE DATA PROTECTION AUTHORITY declares, pursuant to Article 57(1)(f) of the Regulation, that the processing carried out by the Ministry of Education and Merit—Regional School Office for Lombardy—is unlawful due to a violation of Articles 5(1), subparagraph (a), and Article 6, para 1, subparagraphs (c) and (e), and paragraphs 2 and 3 of the Regulation, as well as Article 2-ter of the Code, under the terms set forth in the reasoning; ORDERS the Ministry of Education and Merit—Regional School Office for Lombardy, in the person of its pro tempore legal representative, with registered office at Viale Trastevere, 76/a - 00153 Rome, Tax ID No. 80185250588, to pay the sum of 10,000 (ten thousand) euros as an administrative fine for the violations indicated in the grounds. It is noted that the offender, pursuant to Article 166, paragraph 8, of the Code, has the right to settle the dispute by paying, within 30 days, an amount equal to half of the imposed penalty; ORDERS the aforementioned Ministry—Regional Education Office for Lombardy—in the event that the dispute is not settled pursuant to Article 166, paragraph 8, of the Code, to pay the sum of 10,000 (ten thousand) in accordance with the procedures set forth in the attachment, within 30 days of service of this order, failing which the necessary enforcement measures will be taken pursuant to Art. 27 of Law No. 689/1981; ORDERS - pursuant to Article 166, paragraph 7, of the Code and Article 16, paragraph 1, of the Data Protection Authority’s Regulation No. 1/2019, the publication of this injunction order on the Data Protection Authority’s website; - pursuant to Article 154-bis, paragraph 3, of the Code and Article 37 of the Data Protection Authority’s Regulation No. 1/2019, the publication of this order on the Authority’s website; - Pursuant to Article 17 of the Authority’s Regulation No. 1/2019, the recording of the violations and the measures adopted in accordance with Article 58(2) of the Regulation in the Authority’s internal register provided for in Article 57(1)(u) of the Regulation. Pursuant to Article 78 of the Regulation, Article 152 of the Code, and Article 10 of Legislative Decree No. 150/2011, an appeal against this decision may be filed with the ordinary courts, on pain of inadmissibility, within thirty days from the date of notification of the decision, or within sixty days if the appellant resides abroad. Rome, July 23, 2026 THE CHAIRMAN Stanzione THE RAPPORTEUR Stanzione THE SECRETARY GENERAL Montuori [Web Doc. No. 10287373] Decision of July 23, 2026 Register of Decisions No. 553 of July 23, 2026 THE DATA PROTECTION AUTHORITY AT today’s meeting, attended by Prof. Pasquale Stanzione, Chair; Prof. Ginevra Cerrina Feroni, Vice Chair; Dr. Agostino Ghiglia, Member; and Dr. Luigi Montuori, Secretary General; HAVING REGARD TO Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016, on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC, “General Data Protection Regulation” (hereinafter “Regulation”); HAVING REGARD TO Legislative Decree No. 196 of June 30, 2003, containing the “Code on Data Protection,” which sets forth provisions for the adaptation of national law to Regulation (EU) 2016/679 of the European Parliament and of the Council, of April 27, 2016, on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC” (hereinafter the “Code”); HAVING REGARD TO Regulation No. 1/2019 concerning internal procedures with external relevance, aimed at the performance of the duties and the exercise of the powers entrusted to the Data Protection Authority, approved by Resolution No. 98 of April 4, 2019, published in the Official Gazette No. 106 of May 8, 2019, and at www.gpdp.it, web doc. No. 9107633 (hereinafter “Regulation of the Data Protection Authority No. 1/2019”); Having regard to the documentation on file; Having regard to the observations made by the Secretary General pursuant to Art. 15 of the Data Protection Authority Regulation No. 1/2000 on the organization and operation of the office of the Data Protection Authority, web doc. No. 1098801; Rapporteur: Prof. Pasquale Stanzione; PREAMBLE 1 Introduction. In a complaint filed pursuant to Article 77 of the Regulation, Ms. XX, an employee of the Ministry of Education and Merit classified in the ATA staff category, alleged a violation of the regulations governing data protection. Specifically, it was alleged that, after being the recipient of a disciplinary dismissal order issued by the Disciplinary Proceedings Office (UPD) of the Monza and Brianza Regional School Office, numerous branches of the Administration (namely, all regional school offices; all schools within the territorial jurisdiction; the teacher and ATA ranking office; the teacher and ATA appointments office; and the pensions office) had been notified of the dismissal via email. 2 The Preliminary Investigation. In response to a request for information made pursuant to Article 157 of the Code (see note ref. no. XX dated XX), the Ministry of Education and Merit—Regional School Office for Lombardy, in a letter dated XX (Ref. No. XX), stated, in particular, that: - “the [UPD], by decision Ref. No. XX dated XX, imposed on the [complainant…] the penalty of dismissal with notice pursuant to Article 25, paragraph 9, Chapter I, subparagraphs (a) and (g) of the National Collective Bargaining Agreement for the Education and Research Sector for the 2019–2021 three-year period”; - the aforementioned Office “by confidential memo ref. no. XX dated XX […] notified all Regional School Offices, the State Educational Institutions within the Monza and Brianza Territorial Area, as well as to the Teacher and ATA Ranking Lists and Pensions Offices within the Monza and Brianza Territorial Area, the name and identifying information of the employee who, following the disciplinary proceedings, had been subjected to the sanction of dismissal […]”; - “the other Regional Education Offices—as well as the Territorial Area Offices—cannot in any way be classified as ‘third parties,’ since they are offices lacking legal autonomy, merely serving as regional and provincial territorial branches of the same, single School Administration of the Ministry […]”; - “The same applies to educational institutions which, although endowed with autonomy […], are functionally ‘subordinate’ to the Ministry […] and, in particular, school staff are in an employment relationship with the Ministry”; - “[…] notification of dismissal […] to the branches of the same Ministry appears necessary to ensure the legality of recruitment procedures at the Territorial Offices and educational institutions, thereby preventing the dismissed employee—by failing to disclose the disciplinary action taken—from entering into employment contracts with the school administration”; - “since […] the disciplinary sanction of dismissal constitutes a specific impediment to participation in competitive selection procedures and to the inclusion of the data subject in provincial and school-level rankings for substitute teaching positions, the aforementioned notice was sent to the aforementioned Offices for their information and for any necessary decisions within their jurisdiction”; - the complainant, in fact, “[…] could have submitted an application to a School Office of the Republic and to a School Institution of the Republic for inclusion in the first- and third-tier rankings, respectively”;the notification to the Offices […], therefore, was necessary as the only way to prevent the dismissed employee—by failing to disclose a disciplinary dismissal—from being included in the provincial and school-level rankings in Lombardy and other regions, in violation of the provisions of Art. 2, paragraph 7, of Presidential Decree No. 487 of May 9, 1994, which provides that ‘those who have been […] dismissed for […] disciplinary reasons pursuant to applicable statutory or contractual provisions may not be hired by public administrations’”; - “Ministerial Order No. 21 of February 23, 2009 […] in Art. 7.3(c), provides that “those who have incurred the disciplinary sanctions provided for by the current National Collective Bargaining Agreement for the school sector (dismissal with notice and dismissal without notice) may not participate in the procedure” and similarly, Decree No. 89 of May 21, 2024, issued by the Ministry of Education and Merit […] provides that “those who have been dismissed or relieved of their duties from a public administration due to persistent unsatisfactory performance, or who have been terminated for just cause or for a justified subjective reason, may not participate in the hiring procedure”; - “Notification to other offices of the mere termination of the employee’s employment relationship, without making specific reference to the disciplinary dismissal decision, cannot be considered sufficient to satisfy the legal purpose indicated above - specifically, the purpose of precluding the data subject from being rehired — since the termination of the employment relationship constitutes a very broad category that includes, for example, voluntary resignations, which do not preclude the employee from applying for inclusion in the ranking lists of any province or educational institution, with the possible subsequent execution of employment contracts with the administration. The contested notice is also necessary for the employer to address false statements regarding compliance with the requirements prescribed by sector-specific regulations.” By letter dated XX (ref. no. XX), the Office of the Data Protection Commissioner, based on the information gathered, the verifications carried out, and the facts that emerged following the preliminary investigation, notified the Ministry of Education and Merit - the Regional School Office for Lombardy, pursuant to Art. 166, paragraph 5, of the Code, the initiation of proceedings for the adoption of the measures referred to in Article 58, para 2, of the Regulation, for having conducted personal data processing relating to the disciplinary measure in a manner inconsistent with the principle of “lawfulness, fairness, and transparency” and in the absence of a legal basis, in violation of Articles 5(1)(a), 6(1)(c) and (e), and 6(2) and (3) of the Regulation, as well as Article 2-ter of the Code. In the same notice, the aforementioned data controller was invited to submit written defenses or documents to the Data Protection Authority or to request a hearing before the Authority (Art. 166, paragraphs 6 and 7, of the Code, as well as Article 18, paragraph 1, of Law No. 689 of November 24, 1981). By letter dated XX (Ref. No. XX), the Ministry of Education and Merit—Regional School Office for Lombardy—submitted a defense brief, stating, in particular, that: - “[…] the primary activity of the Territorial Areas is the recruitment of school staff to ensure the proper start of the school year, using [, in particular…] the ‘24-month’ rankings for ATA staff […]. The same applies to schools that fill vacant and available positions with substitute teachers, as well as to replace staff absent for various reasons during the school year, using […] the third-tier school-specific rankings for ATA staff”; - it is necessary to “prevent […] a dismissed employee, by failing to disclose the disciplinary sanction imposed—which precludes employment—from entering into employment contracts with the school administration […]. To enable the rapid retrieval of such information, the offices of the Ministry of Education and Merit exchange the contested communications—internal documents within the Ministry’s territorial divisions—in compliance with privacy regulations, and also send them to educational institutions, which are themselves divisions of the Ministry”; - “the ranking/appointment offices […], although part of the same administration, are responsible for verifying the requirements under Art. “Article 2, paragraph 7, of Presidential Decree No. 487/1994”; - “The legal system provides for a convergence of sources establishing a prohibition on hiring individuals who have been dismissed for disciplinary reasons, creating an implicit yet stringent and timely obligation for internal notification […]. When read systematically, these provisions establish that the candidate’s self-certification alone is not sufficient […]”; - “[…] the recipients of the notification have specific institutional duties that require knowledge of the disciplinary dismissal […]”; - “[…] the Regional School Offices (UU.SS.RR.) and Territorial School Offices (UU.SS.TT.) need to be aware of disciplinary dismissals in order to prevent dismissed staff from being rehired through self-certification during recruitment processes by failing to disclose the cause of the termination of their previous employment relationship, as do school administrators responsible for recruiting teachers and ATA staff from school-level ranking lists. Similarly, the Teacher and ATA Ranking Offices of the Monza and Brianza Territorial Area—which handle recruitment from the GAE and GPS for teachers and from the “24-month” ranking for ATA staff, respectively, need to be aware of disciplinary dismissals in order to prevent the fraudulent inclusion of dismissed personnel. Furthermore, the notification was forwarded to the Pension Office of the Monza Territorial Area (AT) to complete all procedures resulting from the termination of employment […;] the recipient offices require this information not to manage the employment relationship that has already ended, but to prevent unlawful inclusion in ranking lists of other provinces, to prevent the permanent appointment of individuals who do not meet the legal requirements, and to comply with the verification obligation imposed by Art. 2, paragraph 7, of Presidential Decree 487/1994”; - “The verification under Article 71 is not structurally suitable for the education sector, as administrative offices and schools conduct verifications ‘including on a sample basis’ and ‘in cases of reasonable doubt.’ In particular, the provincial rankings (GAE, GPS, and 24-Month Rankings) and school-level rankings (Categories I and II for teaching staff and Category III for ATA staff) for substitute teaching positions involve tens of thousands of candidates in each province; appointments are made within extremely tight timeframes, often automatically via an algorithm, making it difficult to conduct comprehensive preventive checks; “reasonable doubt” presupposes that the administering authority already possesses information regarding the candidate that the self-certification system, by definition, does not provide if the data subject makes a false declaration. Furthermore, random sampling is, by definition, probabilistic and does not guarantee the identification of every single false statement”; - “A school administration office that possesses information regarding one of its employees—in particular, regarding a condition that precludes employment—is obligated under Article 97 of the Constitution to make that information available to other offices within the same administration […]; there is no automated national database of disciplinary sanctions against school personnel accessible to all Territorial Offices and schools that manage ranking lists and hiring. It is therefore necessary for the Offices to comply with the legal obligation not to hire or include on ranking lists individuals who have been dismissed for disciplinary reasons […]”; - “The Monza and Brianza Territorial Office has [nevertheless] suspended all communications regarding disciplinary dismissals […] pending the decisions that will be made.” 3 Outcome of the Preliminary Investigation. Following the investigation into the complaint, it was established that, after imposing a disciplinary measure of dismissal against the complainant, the Disciplinary Proceedings Office of the Monza and Brianza Territorial Area, via an email dated XX (Ref. No. XX), with the subject line “CONFIDENTIAL_Notification of Disciplinary Dismissal Measures,” attached to said message the note ref. no. XX dated XX, with the subject line “Notification of Disciplinary Dismissal Measures Against Staff Employed at Educational Institutions Falling Under the Jurisdiction of the Monza and Brianza Territorial Area - School Year 2024–2025,” addressed to “the Regional School Offices,” the “Principals of State Educational Institutions of all levels – Monza and Brianza Territorial Area,” as well as “to the Teacher and ATA Ranking Offices,” “Teacher and ATA Appointments,” and “Pensions.” This notice informed the recipients “for their information and to fulfill their respective obligations, [of] the name of the employee to whom, following the conclusion of disciplinary proceedings, this Territorial Area imposed the sanction of dismissal with notice […]”; the complainant was identified therein by reference to her first name, last name, place and date of birth, and job title, and explicit reference was made to the type of disciplinary sanction imposed, as well as the date and reference number of the disciplinary measure in question. That said, it should be noted that public entities, within the workplace context, may process the personal data of data subjects if the processing is necessary, in general, for the management of the employment relationship and to fulfill specific obligations or tasks provided for by law or by Union or Member State law; Furthermore, processing is lawful when it is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller (Articles 6(1)(c) and (e), and para 2 and para 3, of the Regulation). European legislation provides that “Member States may maintain or introduce more specific provisions to adapt the application of the rules of the […] Regulation with regard to processing in accordance with paragraph 1(c) and (e), by laying down more precise specific requirements for processing and other measures to ensure lawful and fair processing […]” (Article 6, para 2, of the Regulation). In this regard, it should be noted that the “disclosure” of personal data to third parties by public entities is permitted only if the conditions set forth in Article 2-ter of the Code are met. The controller is required, in any case, to comply with data protection principles, including those of “lawfulness, fairness, and transparency” as well as “data minimisation,” according to which personal data must be “processed lawfully, fairly, and transparently in relation to the data subject” and “adequate, relevant, and limited to what is necessary in relation to the purposes for which they are processed” (Art. 5, para. 1, subpars. (a) and (c), of the Regulation). In this context, public administrations must take the most appropriate measures to prevent the unjustified disclosure of personal data to third parties or entities other than the recipient (see section 5.3 of the “Guidelines on the Processing of Employees’ Personal Data for the Purpose of Managing Employment Relationships in the Public Sector,” provision of June 14, 2007, at www.gpdp.it, web doc. no. 1417809). In the case at hand, the Ministry of Education and Merit—Regional School Office for Lombardy—has not cited any provision of the school regulations, suitable in terms of rank and nature, that expressly provides for thean obligation for the UPD to inform other Regional School Offices or state schools of all instances within the same territorial jurisdiction, or other offices of the Ministry, regarding the adoption of disciplinary measures involving dismissal against teachers or administrative staff. In this regard, the defense’s argument—that such disclosure of personal data was necessary pursuant to the provisions of Article 2, paragraph 7, of Presidential Decree No. 487 of May 9, 1994, which states that “persons who have been […] dismissed for […] disciplinary reasons pursuant to applicable statutory or contractual provisions may not be hired by public administrations.” This is because the same decree, in Art 4, paragraph 2, subparagraph (f), provides that, as part of the process for participating in a competitive selection procedure through the InPA Portal, the candidate must only declare, “as a declaration in lieu of certification pursuant to Article 46 of the Consolidated Law referred to in Presidential Decree No. 445 of December 28, 2000, […] that they have not been […] dismissed pursuant to applicable statutory or contractual provisions.” The accuracy of this declaration may then be verified by the contracting authority in accordance with the procedures set forth in Article 71 of Presidential Decree No. 445 of December 28, 2000, namely, “including on a random basis […] and in cases of reasonable doubt.” Similarly, Ministerial Order No. 21 of February 23, 2009, which was also invoked to support the lawfulness of the conduct in the case subject to the complaint, provides that “those who […] have been subject to the disciplinary sanctions provided for in the current national collective bargaining agreement for the ‘School’ sector (dismissal with notice and dismissal without notice) may not participate in the procedure” (Art. 7.3, subpar. c)), as it is stipulated in this regard that “the application form must include, pursuant to Presidential Decree No. 445 of December 28, 2000, a declaration of the requirements for admission to the competitive examination […]” and that “the Administration reserves the right to verify the declarations and self-certifications” (Art. 8.8). Therefore, since the possibility that an employee who has been subject to disciplinary dismissal might apply for another competitive selection process or request inclusion in school ranking lists is merely hypothetical, and since the sector-specific regulations, even in such a scenario, having established specific procedures for certifying eligibility requirements and conducting the relevant verifications, the processing at issue in the complaint is not supported by the sector-specific regulations governing the matter and is therefore not supported by a legal basis. As for the claim made during the preliminary investigation that the recipients of the email in question cannot be considered third parties—since they are merely internal units of the Ministry—it should be noted that, as the Data Protection Authority has long clarified through general provisions and decisions on individual cases, the personal data of employees, processed for the purpose of managing the employment relationship—including information concerning the termination of such relationship (see Art. 88, para 1, of the Regulation, which expressly mentions the “purpose of terminating the employment relationship,” cannot, as a general rule, be disclosed to parties other than those who are part of the specific employment relationship (see the definitions of “personal data” and “data subject” contained in Art. 4(1)(1) of the Regulation), or of those who—even taking into account the definition of “third party,” as defined in Article 4(1)(10) of the Regulation—are not authorized to process such data by virtue of their assigned duties and the organizational decisions of the controller. This applies even within particularly complex and geographically structured organizations, such as the Ministry in question. Conversely, no violation of personal data protection regulations can be found in cases where individuals responsible for specific duties become aware of the personal data of data subjects when such knowledge is necessary for the performance of the functions assigned to them. These principles have been applied by the Data Protection Authority in accordance with established case law in numerous specific cases. Furthermore, educational institutions—which were also among the recipients of the aforementioned notice—are to be considered legal entities distinct from the Ministry and, therefore, from the perspective of personal data protection, they act as independent controllers of processing. The recipients of the notice sent by the Office of Disciplinary Proceedings (all Regional School Offices throughout the country; public schools of all levels within their respective jurisdictions; the Offices for Teacher and ATA Rankings, Teacher and ATA Appointments, and Pensions) did not need to be informed in advance of the disciplinary measure of dismissal imposed on the complainant; that is to say, regardless of any new application or request to fill a job position, they could not, therefore, consider themselves authorized to process the data, and consequently, their status as “third parties” for the purposes of personal data protection legislation became relevant; indeed, the communication in question was addressed to them in general terms “for their information and to fulfill their respective obligations,” without specifying—not even during the preliminary investigation—the nature of the specific obligations incumbent upon the aforementioned offices that might necessitate the processing of the information in question for the performance of their respective institutional duties. Also in accordance with the principles of data processing necessity and data minimisation (see Articles 6(1)(c) and 5(1)(c) and (e), and para 2 and para 3, of the Regulation), it would have been, on the other hand, sufficient, for the purposes of any obligations falling within their jurisdiction, to provide only the information that the employment relationship had been terminated, without details regarding the lawsuit that led to its termination. This is also true considering that information regarding disciplinary dismissal, even though it does not fall within the special categories of data referred to in Article 9 of the Regulation, constitutes, in any case, particularly sensitive information which, if made available—as occurred in the present case—to a wide audience of recipients, can have significant detrimental effects on the personal and professional legal sphere of the data subject. In light of the foregoing considerations, it must be concluded that, by disclosing the complainant’s personal data in the case at issue, the Ministry of Education and Merit—Regional School Office for Lombardy—acted in a manner inconsistent with the principle of “lawfulness, fairness, and transparency” and without a legal basis, in violation of Articles 5(1)(a), 6(1)(c) and (e), and 6(2) and (3) of the Regulation, as well as Article 2-ter of the Code. 4 Conclusions. In light of the above assessments, it is noted that the statements made by the controller during the preliminary investigation—for the veracity of which the controller may be held accountable pursuant to Art. 168 of the Code—although worthy of consideration, do not suffice to rebut the objections notified by the Office in the notice initiating the proceedings and are insufficient to warrant the dismissal of these proceedings, as none of the cases provided for in Art. 11 of the Data Protection Authority’s Regulation No. 1/2019 apply. Therefore, the preliminary assessments of the Data Protection Authority’s Office are confirmed, and the processing of personal data by the Ministry of Education and Merit—Regional School Office for Lombardy—is found to be unlawful, as it processed the complainant’s personal data in violation of Articles 5, (1)(a), and 6(1)(c) and (e), and (2) and (3) of the Regulation, as well as Article 2-ter of the Code. Given that the violation of the aforementioned provisions occurred as a result of a single act (the same processing operation or related processing operations), Article 83, para 3 of the Regulation applies, pursuant to which the total amount of the administrative fine shall not exceed the amount specified for the most serious violation. Given that, in the present case, all violations are subject to the penalty provided for in Article 83, para 5, of the Regulation, as also referred to in Article 166, para 2, of the Code, the total amount of the fine is to be set at up to 20,000,000 euros. In this context, and considering, in any event, that the conduct has ceased to have any effect, the conditions for adopting further corrective measures under Art 58(2) of the Regulation are not met. 5 Adoption of the injunction order for the imposition of the administrative fine and ancillary penalties (Articles 58(2)(i) and 83 of the Regulation; Article 166, paragraph 7, of the Code). The Data Protection Authority, pursuant to Articles 58(2)(i) and 83 of the Regulation as well as Article 166 of the Code, has the power to “impose an administrative fine pursuant to Article 83, in addition to the [other] [corrective] measures referred to in this paragraph, or in lieu of such measures, depending on the circumstances of each individual case” and, in this context, “the Board [of the Data Protection Authority] issues an injunction, by which it also orders the application of the ancillary administrative sanction of its publication, in full or in part, on the Data Protection Authority’s website pursuant to Article 166, paragraph 7, of the Code” (Art. 16, paragraph 1, of the Data Protection Authority’s Regulation No. 1/2019). In this regard, taking into account Article 83(3) of the Regulation, in the present case, the violation of the aforementioned provisions is subject to the application of the administrative fine provided for in Article 83(5) of the Regulation. The amount of the aforementioned administrative fine, depending on the circumstances of each individual case, must be determined by taking due account of the factors set forth in Article 83(2) of the Regulation. Taking into account that: - although the data were disclosed to a wide audience and the processing involved sensitive data—as they related to a disciplinary measure—the established violation concerned the personal data of only one data subject (see Article 83(2)(a) and (g) of the Regulation); - the violation was committed through negligence, as the data controller made a legal error in interpreting the relevant legislation and applying it within the specific and complex organizational context of education, albeit with the intention of protecting the public interest (see Article 83(2)(b) of the Regulation); it is considered that, in the present case, the level of severity of the violation committed by the controller is low (see European Data Protection Board, “Guidelines 4/2022 on the calculation of administrative fines under the GDPR” of May 24, 2023, paragraph 60). That said, given that the controller is a Ministry (even though the violation occurred within a specific division of that Ministry), it is considered that, for the purposes of determining the amount of the fine, the following circumstances should be taken into account: - the data controller cooperated fully with the Authority during the investigation and has also suspended the operational practice it had been following until now (see Art. 83, para. 2, subparagraph f), of the Regulation); - there are no relevant prior violations committed by the controller (see Article 83(2)(e) of the Regulation). In light of the aforementioned factors, assessed as a whole, the Authority has determined the amount of the administrative fine to be 10,000 (ten thousand) euros for the violation of Articles 5(1)(a) and 6(1), para 1, subparagraphs (c) and (e), and paragraphs 2 and 3 of the Regulation, as well as Article 2-ter of the Code, as an administrative fine deemed, pursuant to Article 83(1) of the Regulation, to be effective, proportionate, and dissuasive. It is also deemed that, pursuant to Article 166, paragraph 7, of the Code and Article 16, paragraph 1, of the Data Protection Authority’s Regulation No. 1/2019, this section containing the injunction order must be published on the Data Protection Authority’s website. This is in light of the sensitive nature of the data being disclosed to a wide range of third parties and the possible detrimental consequences for the complainant’s private and professional life. Finally, it is noted that the conditions set forth in Art. 17 of Regulation No. 1/2019 are met. IN VIEW OF THE FOREGOING, THE DATA PROTECTION AUTHORITY declares, pursuant to Article 57(1)(f) of the Regulation, that the processing carried out by the Ministry of Education and Merit—Regional School Office for Lombardy—is unlawful due to a violation of Articles 5(1), subparagraph (a), and Article 6, para 1, subparagraphs (c) and (e), and paragraphs 2 and 3 of the Regulation, as well as Article 2-ter of the Code, as set forth in the reasoning; ORDERS the Ministry of Education and Merit—Regional School Office for Lombardy, in the person of its pro tempore legal representative, with registered office at Viale Trastevere, 76/a - 00153 Rome, Tax ID No. 80185250588, to pay the sum of 10,000 (ten thousand) euros as an administrative fine for the violations indicated in the grounds of this decision. It is noted that the offender, pursuant to Article 166, paragraph 8, of the Code, has the right to settle the dispute by paying, within 30 days, an amount equal to half of the imposed penalty; ORDERS the aforementioned Ministry—Regional Education Office for Lombardy—in the event that the dispute is not settled pursuant to Article 166, paragraph 8, of the Code, to pay the sum of 10,000 (ten thousand) in accordance with the procedures set forth in the attachment, within 30 days of the service of this order, failing which the necessary enforcement measures will be taken pursuant to Art. 27 of Law No. 689/1981; ORDERS - pursuant to Article 166, paragraph 7, of the Code and Article 16, paragraph 1, of the Data Protection Authority’s Regulation No. 1/2019, the publication of this injunction order on the Data Protection Authority’s website; - pursuant to Article 154-bis, paragraph 3, of the Code and Article 37 of the Data Protection Authority’s Regulation No. 1/2019, the publication of this order on the Authority’s website; - Pursuant to Article 17 of the Authority’s Regulation No. 1/2019, the recording of the violations and the measures adopted in accordance with Article 58(2) of the Regulation in the Authority’s internal register provided for in Article 57(1)(u) of the Regulation. Pursuant to Article 78 of the Regulation, Article 152 of the Code, and Article 10 of Legislative Decree No. 150/2011, an appeal against this decision may be filed with the ordinary courts, under penalty of inadmissibility, within thirty days from the date of notification of the decision, or within sixty days if the appellant resides abroad. Rome, July 23, 2026 THE CHAIRMAN Stanzione THE RAPPORTEUR Stanzione THE SECRETARY GENERAL Montuori